CLAIMS 



Amend the claims as follows. 

1 . (Currently Amended) A comput e r ' impl em ent e d m e thod for d e t e ction of 
it e ms stor e d in a computer s ystem such us comput e r cod e. -d ata or information, th e 
method, comprising; 

obtaining a signature by reading code comprisin g a partial section at- l e a s t part of 
a steganographic program , wherein the steganographic program is configured to 
introduce steganographic items into a computer file; ca p able of introducing th e items, the 
c od e incorporating suffici e nt data to characterise th e program ad e quat e ly, using the cod e- 
as th e s ignature, 

comparing the signature with one or more computer files; stored o n the comp uter 
system-.-and if 

displaying a listing of which of the one or more computer files provide a match 
with the signature is found, providing an indication th e r e of . 

2. (Currently Amended) The [[A]] method according to Claim l a wherein the 
listing includes indication incorporat e s an identification of at l e ast one e f 

a)-an4fc em r e sponsible for the match, 
b^-fche-nat ure of th e item, 

e) the steganographic items it e m's location ina the computer system-rand 
d)-the-m atching signatur e. 

3. (Cancelled) 

4. (Currently Amended) The [[A]] method according to Claim 1. wherein the 
cod e comprises a .DLL file that is read is one of the fe 4few4ngH- 

a ) a c on tinuo us -^eq^ienc^-ef-^mgi : am-eedet 

b) a continuous s e qu e nc e of program code and beginning where its program 

beg ins; 

c) a continuous sequenc e of program code hut not mor e than 5% and not l e ss than 
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0,167% of its program's code: 




e ) a .DDL or .ocx fil e : -and 

5. (Currently Amended) The [[A]] method according to Claim l a wherein an 
asserted file type is ignored when comparing the one or more computer files with the 
signature. 

6. (Currently Amended) The [[A]] method according to Claim 1 , further 
comprising: whe rein the st e p of comparing th e signature with files is for each fi le 
pr e ced e d by 

checkings the respective real file type by reading_a the start of the one or more 
computer files: file and 

excluding files having prearranged initial byte sequences from the comparison 
comparing with the signature . 

7. (Currently Amended) The [[A]] method according to Claim 1 A wherein 
files not accessible by a system administrator are excluded from the comparison with the 
s ignat u re. 

8. (Currently Amended) The [[A]] method according to Claim l a wherein the 
one or more computer files comprise compared with the signature includ e4egieat 
wast e baslc e t fil es deleted files and compr e ss e d fil e s . 

9. (Currently Amended) The [[A]] method according to Claim l a wherein the 
one or more computer files comprise compared with the s tgnatee4nefade sel f-extracting 
executable files and polymorphic file? . 

1 0. (Currently Amended) The [[A]] method according to Claim 1, wherein in 



a for e said is giv e n despite their containing code which matches the [[a]] signature. 



some prearranged files are not identified in the listing no indication as 
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1 1 . (Currently Amended ) A computer Computer- apparatus comprising a 
storage device for storing one or more files, wherein the computer apparatus is fer 



programm e d configured to: 

a)-obtain a signature by reading a part i al section of code compri s ing at least part 
of a program , wherein the program is configured to introduce steganographic HsapaMe-ef 
introducing th e items into a computer file: , th e cod e in c orporating suffici e nt data to 
charact e ris e th e program ad e quat e l y; 

h4 us e the cod e as th e .signatur e , 

e) compare the signature with the one or more files stored on th e storage device: 
comput e r apparatus, and 

d)4f when a match with the signature is found, providing an indication o f indicate 
which of the one or more files provide the match thereof. 



12. (Currently Amended) Apparatus The apparatus according to Claim 1 1 A 
wherein the indication incorporates an identification of at l e ast one of: 

a) an it e m r e sponsible for the match, 

b) the nature of the item, 

c) th e it e m's location in the computer syst e m, and 
4) the matching signature. 



13. (Cancelled) 



14. (Currently Amended) Apparatus The apparatus according to Claim 1 1 ^ 
wherein the code of the signature comprises is one of th e fo llo w in g : 

a) a continuous sequence o f the partial section of the program code; 

b) -*^efltinTOUfrsee |u^^ w h eFe 4fe-^fegram 

e)-a-eentiRueus-$equ«H«e~^^ 
0. 1 67% of its program's code; 
d) a program k e rn e l; 
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e ) u .DDL or .ocx fil e ; and 

f) code impl e m e nting b oth-write-tt-v and r e ad #em-a-fik. 

15. (Currently Amended) Affgarates The apparatus according to Claim 1 1 a 
wherein one or more predetermined p rogramm e d to ignor e ass e rted file types are not 
compared typ e wh e n comparing fil e s with the signature. 

1 6. (Currently Amended) Apparatus The apparatus according to Claim 1 1 a 
wherein the partial section of code comprises a p rogramm ed4e-^he^k-fer-^a^h-#le4he 
respective reaHite4yfte-by- readmg the start of th e computer file, and wherein e xcluding 
files having prearranged initial byte sequences are excluded from the comparison-raad-te 
ebe^-as-afefesa M befor e comparing the signature with files . 

17. (Currently Amended) Apparatus The apparatus according to Claim 1 l a 
wherein programmed to e xclude files not accessible by a system administrator are 
excluded from the comparison with th e signature . 

1 8. (Currently Amended) Apparatus The apparatus according to Claim 1 1 4 
wherein the one or more files comprise programmed to compare with the signatur e 
logical wastebasket files , d e l e ted fil e s and compr e ss e d files . 

1 9. (Currently Amended) Apparatus The apparatus according to Claim 1 1 4 
wherein the one or more files comprise programm e d to compare w 4th4 he^ - gn a4»e-setf- 
e xtracting e x e cutabl e fil e s and polymorphic files. 

20. (Currently Amended) App aratus The apparatus according to Claim 1 1 4 
wherein one or more predetermined files are not indicated pro gram m ed to -give-no 
ffldiea^H H ^-afefesaidHffl-^esp ect of seme-pfeaffaftged fi l es despite their containing code 
which matches a signature. 

21. (Cancelled) 
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22. (Currently Amended) [[A]]The computer readable medium software 
product according to Claim 31 , further comprising ide ntifying4 n-#ta^wbaFein4he 

a steganographic4 -an item responsible for the match-, 

b) th e natur e of the it e m -.- 

c) th e it e m' f i locution in th e comput er-syst e m. and 

d) th e matching signature. 



23. (Cancelled) 



24. (Currently Amended) [ [A] ]The compute r readable medium software 
p r o d u ct according to Claim 3 1^ wherein the signature comprises is one of th e-f e lle w ing; 

a) a c onti nu ous sequence of program code; 

b) a continuous sequence of program cod e and beginning whor e its program 

b egin s^ 

e) a continuous sequence of program code but not more than 5% and not less than 
0.1 67% o f the program its program's code; 

d) a program kern e l; 

e ) a .DDL or .ocx file; and 

f) - code implem e nting both writ e to and road from a file . 

25. (Currently Amended) [[A]]The compute r readable medium software 
product according to Claim 3 1 ^ wherein an the instructions provide for the comput e r 
apparatus to ignore asserted file typ e is not compared wh e n compaBng - ft les with the 
signature. 

26. (Currently Amended) [[A]]The computer readable medium software 
product according to Claim 31 A wherein th e method further comprises: 

by reading_a the start of the one or more files: file and e xclud e 

excluding files having prearranged initial byte sequences from the comparison 
w4#i-the-$4gflature T -and t o do-so-prior to com^esmi^ie^i^tie^e^wi^&Bs. 
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27. (Currently Amended) [[A]]The compute r readable medium software 
product according to Claim 3 l a wherein th e instH *etk*fts- f>rovid e for th e comput e r 
apparatus to e xclud e from comparison with the si gnature files that are not accessible by a 
system administrator are excluded from th e comparison . 

28. (Currently Amended) [[A]]The compute r readable medium software 
product according to Claim 3 1, wherein the one or more files comprise mstoetiefts 
pfevide^feF4h^-€em^uteFQppamt us to co fflpfl^e-wtth-th e - s -tgnatufe logical wastebasket 
files^deteted-lttes- and-eem pr- essed files . 

29 . (Currently Amended) [ [A] ]The compute r readable medium soft w a re 
p red u et according to Claim 3 1^ wherein the one or more files comprise instruction s 
provide for th e computer apparatus to compar e with the signature self-extracting 
executable files and polymorphic fil es. 

3 0 . (Currentl y Amended) [ [A] ] The compute r readable medium software 
preduet according to Claim 31 , further comprising displaying the file which provides the 
match, wherein th e instructions provid e for the comput e r apparatus to giv e no indicatio n 
as aforesaid in respect of some prearranged files associated with certain file types are not 
displayed despite their containing code which matches the [[a]] signature. 

3 1 . (Currently Amended) A tangible computer softwar e-prod uct comp r is mg-a 
computer readable medium having stored therein containing computer readable 
instructions-fer controll i ng ope ration of computer apparatus to im plem e nt d e t e ctten-ef 
rteffls-stered4r^-eerBputer-sy^terfi-s^ h as co mputer co d e , data or4rd^rmati«ft7-wherera 
^rmmp^s^mAsM^m^m^ms^e^i de a means for cont rellmg-t he-e e m pu ter 
apparatu s to that, if executed by a system, cause the system to perform a method 
comprising : 

obtaining a) obtain a signature by reading code comprising at l e ast part of a 
program capable of introducing stegano graphic the items ;, th e cod e incorporating 
sufficient data to characteris e th e program ad e quately. 
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b) us e th e code as the signatu re-. 

comparing c) compar e the signature wit h one or more files; stored on the 
identifying a file which provides the match ? 

d) if a match with th e s ignatur e is found, to pr ovide a n indication th e r e of . 

32. (New) The computer readable medium according to claim 3 1 , wherein the 
method further comprises executing the one or more files, and wherein the comparison is 
made prior to executing the one or more files. 

33. (New) The method according to claim 1 , further comprising running a 
virus checking program while comparing the signature with the one or more computer 
files. 

34. (New) The apparatus according to claim 15, wherein the one or more 
predetermined file types comprise a graphic editor. 

35. (New) An apparatus, comprising: 
means for storing one or more files; 

means for obtaining a signature by reading a partial section of code of a program, 
wherein the program is configured to introduce steganographic items into a computer file; 
means for comparing the signature with the one or more stored files; and 
when a match with the signature is found, means for indicating which of the one 
or more stored files provide the match. 
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